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Abstract —Security assessment of large-scale, strongly nonlin¬ 
ear power grids containing thousands to millions of interact¬ 
ing components is a computationally expensive task. Targeting 
at reducing the computational cost, this paper introduces a 
framework for constructing a robust assessment toolbox that 
can provide mathematically rigorous certificates for the grids’ 
stability in the presence of variations in power injections, and for 
the grids’ ability to withstand a bunch sonrces of fanlts. By this 
toolbox we can “off-line” screen a wide range of contingencies or 
power injection profiles, without reassessing the system stability 
on a regular basis. In particular, we formulate and solve two 
novel robust stability and resiliency assessment problems of 
power grids subject to the uncertainty in equilibrium points 
and uncertainty in fault-on dynamics. Fnrthermore, we bring in 
the quadratic Lyapunov functions approach to transient stability 
assessment, offering real-time construction of stability/resiliency 
certificates and real-time stability assessment. The effectiveness of 
the proposed techniques is numerically illustrated on a number 
of IEEE test cases. 


I. Introduction 

A. Motivation 

The electric power grid, the largest engineered system ever, 
is experiencing a transformation to an even more complicated 
system with increased number of distributed energy sources 
and more active and less predictable load endpoints. Intermit¬ 
tent renewable generations and volatile loads introduce high 
uncertainty into system operation and may compromise the 
stability and security of power systems. Also, the uncontrol¬ 
lability of inertia-less renewable generators makes it more 
challenging to maintain the power system stability. As a result, 
the existing control and operation practices largely developed 
several decades ago need to be reassessed and adopted to more 
stressed operating conditions Q-0. Among other challenges, 
the extremely large size of the grid calls for the development 
of a new generation of computationally tractable stability 
assessment techniques. 

A remarkably challenging task discussed in this work is 
the problem of security assessment defined as the ability of 
the system to withstand most probable disturbances. Most 
of the large scale blackouts observed in power systems are 
triggered by random short-circuits followed by counter-action 
of protective equipments. Disconnection of critical system 
components during these events may lead to loss of stability 
and consequent propagation of cascading blackout. Modern 
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Independent System Operators in most countries ensure sys¬ 
tem security via regular screening of possible contingencies, 
and guaranteeing that the system can withstand all of them 
after the intervention of special protection system Q. The 
most challenging aspect of this security assessment procedure 
is the problem of certifying transient stability of the post¬ 
fault dynamics, i.e. the convergence of the system to a normal 
operating point after experiencing disturbances. 

The straightforward approach in the literature to address 
this problem is based on direct time-domain simulations of 
the transient dynamics following the faults 0,16). However, 
the large size of power grid, its multi-scale nature, and the 
huge number of possible faults make this task extremely 
computationally expensive. Alternatively, the direct energy 
approaches 0,0 allow fast screening of the contingencies, 
while providing mathematically rigorous certificates of stabil¬ 
ity. After decades of research and development, the controlling 
UEP method 0 is widely accepted as the most successful 
method among other energy function-based methods and is 
being applied in industry m- Conceptually similar is the 
approaches utilizing Lyapunov functions of Lur’e-Postnikov 
form to analyze transient stability of power systems mm- 

In modern power systems, the operating point is constantly 
moving in an unpredictable way because of the intermittent 
renewable generations, changing loads, external disturbances, 
and real-time clearing of electricity markets. Normally, to 
ensure system security, the operators have to repeat the secu¬ 
rity and stability assessment approximately every 15 minutes. 
For a typical power system composed of tens to hundred 
thousands of components, there are millions of contingencies 
that need to be reassessed on a regular basis. Most of these 
contingencies correspond to failures of relatively small and 
insignificant components, so the post-fault states is close to 
the stable equilibrium point and the post-fault dynamics is 
transiently stable. Therefore, most of the computational effort 
is spent on the analysis of non-critical scenarios. This compu¬ 
tational burden could be greatly alleviated by a robust transient 
stability assessment toolbox, that could certify stability of 
power systems in the presence of some uncertainty in power 
injections and sources of faults. This work attempts to lay a 
theoretical foundation for such a robust stability assessment 
framework. While there has been extensive research literature 
on transient stability assessment of power grids, to the best 
of our knowledge, only few approaches have analyzed the 
influences of uncertainty in system parameters onto system 
dynamics based on time-domain simulations 0, m and 
moment computation 0. 
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B. Novelty 

This paper formulates and solves two novel robust stability 
problems of power grids and introduces the relevant problems 
to controls community. 

The first problem involves the transient stability analysis of 
power systems when the operating condition of the system 
variates. This situation is typical in practice because of the 
natural fluctuations in power consumptions and renewable 
generations. To deal with this problem, we will introduce 
a robust transient stability certificate that can guarantee the 
stability of post-fault power systems with respect to a set of 
unknown equilibrium points. This setting is unusual from the 
control theory point of view, since most of the existing stability 
analysis techniques in control theory implicitly assume that 
the equilibrium point is known exactly. On the other hand, 
from practical perspective, development of such certificates 
can lead to serious reductions in computational burden, as the 
certificates can be reused even after the changes in operating 
point. 

The second problem concerns the robust resiliency of a 
given power system, i.e. the ability of the system to withstand a 
set of unknown faults and return to stable operating conditions. 
In vast majority of power systems subject to faults, initial 
disconnection of power system components is followed by 
consequent action of reclosing that returns the system back 
to the original topology. Mathematically, the fault changes the 
power network’s topology and transforms the power system’s 
evolution from the pre-fault dynamics to fault-on dynamics, 
which drives away the system from the normal stable operating 
point to a fault-cleared state at the clearing time, i.e. the time 
instant at which the fault that disturbed the system is cleared 
or self-dears. With a set of faults, then we have a set of 
fault-cleared states at a given clearing time. The mathematical 
approach developed in this work bounds the reachability set 
of the fault-on dynamics, and therefore the set of fault-cleared 
states. This allows us to certify that these fault-cleared states 
remain in the attraction region of the original equilibrium 
point, and thus ensuring that the grid is still stable after 
suffering the attack of faults. This type of robust resiliency 
assessment is completely simulation-free, unlike the widely 
adopted controlling-UEP approaches that rely on simulations 
of the fault-on dynamics. 

The third innovation of this paper is the introduction of the 
quadratic Lyapunov functions for transient stability assessment 
of power grids. Existing approaches to this problem are based 
on energy function and Lur’e-Postnikov type Lyapunov 
function in, Id), pfi) , both of which are nonlinear non¬ 
quadratic and generally non-convex functions. The convexity 
of quadratic Lyapunov functions enables the real-time con¬ 
struction of the stability/resiliency certificate and real-time 
stability assessment. This is an advancement compared to the 
energy function based methods, where computing the critical 
UEP for stability analysis is generally an NP-hard problem. 

On the computational aspect, it is worthy to note that all 
the approaches developed in this work are based on solv¬ 
ing semidefinite programming (SDP) with matrices of sizes 
smaller than two times of the number of buses or transmission 


lines (which typically scales linearly with the number of 
buses due to the sparsity of power networks). Eor large- 
scale power systems, solving these problems with off-the-shelf 
solvers may be slow. However, it was shown in a number of 
recent studies that matrices appearing in power system context 
are characterized by graphs with low maximal clique order. 
This feature is efficiently exploited in a new generation of 
SDP solvers fTT) enabling the related SDP problems to be 
quickly solved by SDP relaxation and decomposition methods. 
Moreover, an important advantage of the robust certificates 
proposed in this work is that they allow the computationally 
cumbersome task of calculating the suitable Lyapunov func¬ 
tion and corresponding critical value to be performed off-line, 
while the much more cheaper computational task of checking 
the stability/resilience condition will be carried out online. 
In this manner, the proposed certificates can be used in an 
extremely efficient way as a complementary method together 
with other direct methods and time domain simulations for 
contingency screening, yet allowing for effectively screening 
of many non-critical contingencies. 


C. Relevant Work 

In we introduced the Lyapunov functions family 

approach to transient stability of power system. This approach 
can certify stability for a large set of fault-cleared states, deal 


with losses in the systems |18|, and is possibly applicable 
to structure-preserving model and higher-order models of 
power grids m- However, the possible non-convexity of 
Lyapunov functions in Lur’e-Postnikov form requires to relax 
this approach to make the stability certificate scalable to large- 
scale power grids. The quadratic Lyapunov functions proposed 
in this paper totally overcomes this difficulty. Quadratic Lya¬ 
punov functions were also utilized in 1^, ^ to analyze 
the stability of power systems under load-side controls. This 
analysis is possible due to the linear model of power systems 
considered in those works. In this paper, we however consider 
the power grids that are strongly nonlinear. Among other 
works, we note the practically relevant approaches for transient 
stability and security analysis based on convex optimizations 
| [22| and power network decomposition technique and Sum of 
Square programming | |23) . Also, the problem of stability en¬ 
forcement for power systems attracted much interest p4)-p^, 
where the passivity-based control approach was employed. 

The paper is structured as follows. In Section we in¬ 
troduce the standard structure-preserving model of power 
systems. On top of this model, we formulate in Section III 
two robust stability and resiliency problems of power grids, 
one involves the uncertainty in the equilibrium points and 
the other involves the uncertainty in the sources of faults. In 
Section |IV] we introduce the quadratic Lyapunov functions- 
based approach to construct the robust stability/resiliency 
certificates. Section lY] illustrates the effectiveness of these 
certificates through numerical simulations. 

II. Network Model 

A power transmission grid includes generators, loads, and 
transmission lines connecting them. A generator has both 
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internal AC generator bus and load bus. A load only has 
load bus but no generator bus. Generators and loads have 
their own dynamics interconnected by the nonlinear AC power 
flows in the transmission lines. In this paper we consider the 
standard structure-preserving model to describe components 


and dynamics in power systems |27|. This model naturally 
incorporates the dynamics of generators’ rotor angle as well 
as response of load power output to frequency deviation. 
Although it does not model the dynamics of voltages in 
the system, in comparison to the classical swing equation 
with constant impedance loads the structure of power grids 
is preserved in this model. 

Mathematically, the grid is described by an undirected graph 
A(yN',£), where A/" = {1, 2,, lA/”!} is the set of buses and 
£ C M X JV is the set of transmission lines connecting those 
buses. Here, |A| denotes the number of elements in the set 
A. The sets of generator buses and load buses are denoted by 
Q and C and labeled as {!,..., |^|} and {|^| + 1,..., lA/”!}. 
We assume that the grid is lossless with constant voltage 
magnitudes Vk,k G Af, and the reactive powers are ignored. 

Generator buses. In general, the dynamics of generators is 
characterized by its internal voltage phasor. In the context of 
transient stability assessment the internal voltage magnitude 
is usually assumed to be constant due to its slow variation in 
comparison to the angle. As such, the dynamics of the 
generator is described through the dynamics of the internal 
voltage angle 6k in the so-called swing equation; 


'^k6k 6k6k T — O^k G 


( 1 ) 


where, > 0 is the dimensionless moment of inertia of the 
generator, > 0 is the term representing primary frequency 
controller action on the governor, P^k is the input shaft power 
producing the mechanical torque acting on the rotor, and 
is the effective dimensionless electrical power output of the 
kth generator. 

Load buses. Let P^^ be the real power drawn by the load 
at bus, k G C. In general Pfi^, is a nonlinear function 
of voltage and frequency. For constant voltages and small 
frequency variations around the operating point P^^, it is 
reasonable to assume that 


structure-preserving model of power systems as: 

rrikSk + dkSk + ^ akj sin(4 - 6j) =Pmk ,k &G, (4a) 

j^JGk 

dk6k + ^ akj sin(4 - 6j) = - fc S £, (4b) 

j&J^k 

where, the equations ( |4a| l represent the dynamics at generator 
buses and the equations ( |4bl l the dynamics at load buses. 

The system described by equations Q has many stationary 
points with at least one stable corresponding to the desired 
operating point. Mathematically, the state of Q is presented 
by (5 = [4,...,(5|g|,4,...,(5|g|,(5|g|+i,...,^|^|]^, and the de¬ 
sired operating point is characterized by the buses’ angles 
4 = ...,0,(5pg|_^^,...,(5]4|]^. This point is not 

unique since any shift in the buses’ angles [5* + c, + 

c, 0,..., 0, -I-c, ..., is also an equilibrium. 

However, it is unambiguously characterized by the angle 
differences = 6^ — 6* that solve the following system 
of power-flow like equations; 

ako sin(4j) = Pk,k (5) 

i^Mk 

where Pk = Pmk , A: S and , fc € £. 

Assumption: There is a solution 6* of equations Q such 
that |4j | < 7 < 7 r /2 for all the transmission lines {k,j} G £. 

We recall that for almost all power systems this assumption 
holds true if we have the following synchronization condition, 
which is established in | [28l , 

\\L'^p\\s,oo < sin 7 . ( 6 ) 

Here, Pi is the pseudoinverse of the network Laplacian matrix, 
P = [Pi,-,P\M\V, and ||a;||£:.oo = max{,j}g£ \x{i) - x{j)\. 
In the sequel, we denote as A ( 7 ) the set of equilibrium points 
4 satisfying that \dlj\ < 7 < 7 r/ 2 ,Vj/c, j} S £. Then, any 
equilibrium point in this set is a stable operating point p 8 | . 

We note that, beside <5* there are many other solutions of 
0 . As such, the power system 0 has many equilibrium 
points, each of which has its own region of attraction. Hence, 
analyzing the stability region of the stable equilibrium point 
6* is a challenge to be addressed in this paper. 


Pdk = Pi + dkSkA & (2) 

where dk > 0 is the constant frequency coefficient of load. 

AC power flows. The active electrical power Pg^ injected 
from the k*^ bus into the network, where k G M, is given by 

Pek = Y. ^kVjBkj sin(4 - 4). kGN. (3) 

j&Pk 

Here, the value I 4 represents the voltage magnitude of the 
bus which is assumed to be constant; Bkj is the (normalized) 
susceptance of the transmission line {fc, j} connecting the k*^ 
bus and 7 *^ bus; A4 is the set of neighboring buses of the k*^ 
bus. Let akj = VkVjBkj. By power balancing we obtain the 


III. Robust Stability and Resiliency Problems 
A. Contingency Screening for Transient Stability 

In contingency screening for transient stability, we consider 
three types of dynamics of power systems, namely pre-fault 
dynamics, fault-on dynamics and post-fault dynamics. In nor¬ 
mal conditions, a power grid operates at a stable equilibrium 
point of the pre-fault dynamics. After the initial disturbance, 
the system evolves according to the fault-on dynamics laws 
and moves away from the pre-fault equilibrium point (5*re- 
After some time period, the fault is cleared or self-dears, and 
the system is at the fault-cleared state 4 = Spixciearing)- 
Then, the power system experiences the post-fault transient dy¬ 
namics. The transient stability assessment problem addresses 
the question of whether the post-fault dynamics converges 
from the fault-cleared state to a post-fault stable equilibrium 
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Fig. 1. Convergence of the post-fault dynamics from two different fault- 
cleared states ^pi'^ciearing)-, which are obtained from two different fauIt-on 
dynamics at the clearing times Tdearing^ to the post-fault equilibrium point 

^post' 


point Spggf. Figure 1^ shows the transient stability of the post¬ 
fault dynamics originated from the fault-cleared states to the 
stable post-fault equilibrium. 

B. Problem Formulation 

The robust transient stability problem involves situations 
where there is uncertainty in power injections Pk, the sources 
of which are intermittent renewable generations and varying 
power consumptions. Particularly, while the parameters dk 
are fixed and known, the power generations Pm^. and load 
consumption P^^ are changing in time. As such, the post-fault 
equilibrium 6*^^^ defined by (|^ also variates. This raises the 
need for a robust stability certificate that can certify stability of 
post-fault dynamics with respect to a set of equilibria. When 
the power injections Pk change in each transient stability 
assessment cycle, such a robust stability certificate can be 
repeatedly utilized in the “off-line” certification of system 
stability, eliminating the need for assessing stability on a 
regular basis. Formally, we consider the following robust 
stability problem: 

(PI) Robust stability w.r.t. a set of unknown equilibria: 

Given a fault-cleared state i5o, certify the transient sta¬ 
bility of the post-fault dynamics described by 0 with 
respect to the set of stable equilibrium points A( 7 ). 

We note that though the equilibrium point 5* is unknown, we 
still can determine if it belongs to the set A ( 7 ) by checking if 
the power injections satisfy the synchronization condition (|^ 
or not. 

The robust resiliency property denotes the ability of power 
systems to withstand a set of unknown disturbances and 
recover to the stable operating conditions. We consider the 
scenario where the disturbance results in line tripping. Then, 
it self-dears and the faulted line is reclosed. For simplicity, 
assume that the steady state power injections Pk are unchanged 
during the fault-on dynamics. In that case, the pre-fault and 
post-fault equilibrium points defined by 0 are the same: 
^pre — ^post — ('^his assumption is only for simplicity of 
presentation, we will discuss the case when 6*^^ f S*^d- 


Flowever, we assume that we don’t know which line is 
tripped/reclosed. Hence, there is a set of possible fault-on 
dynamics, and we want to certify if the power system can 
withstand this set of faults and recover to the stable condition 
5*. Formally, this type of robust resiliency is formulated as 
follows. 

(P2) Robust resiliency w.r.t. a set of faults: Given a power 
system with the pre-fault and post-fault equilibrium point 
S* G A ( 7 ), certify if the post-fault dynamics will return 
from any possible fault-cleared state Sq to the equilibrium 
point 5* regardless of the fault-on dynamics. 

To resolve these problems in the next section, we utilize 
tools from nonlinear control theory. For this end, we separate 
the nonlinear couplings and the linear terminal system in 
0 . For brevity, we denote the stable post-fault equilibrium 
point for which we want to certify stability as i5*. Consider 
the state vector x = \xi,X 2 ,xf\^, which is composed of 
the vector of generator’s angle deviations from equilibrium 
xi = [^1 — ..., (5|p| — their angular velocities 

X 2 = • 5 and vector of load buses’ angle deviation 

from equilibrium 0:3 = [(5|e|+i - ..., (5 |a^| - 

Let E be the incidence matrix of the graph Q{ff,£), so that 
E[6i ,... ,<5|aA|]'^ = [(4 - 4){fcj}e£]^- Let the matrix C be 

dd\dmy.nfi Omxn: £^{n—m)x2m ^{n—m)x{n—m)]' Then 

Cx = i:;[4 - 4,..., Vi - = [(4, - 

Consider the vector of nonlinear interactions F in the simple 
trigonometric form: F{Cx) — [(sin4i — sin4j){fc,j}G£]^- 
Denote the matrices of moment of inertia, frequency con¬ 
troller action on governor, and frequency coefficient of load 
as Ml = .. ,m\g\),Di = diag(di,..., d|g|) and 

M = diag(mi,..., m|e|, d\g\+i,d\^\). 

In state space representation, the power system 0 can be 
then expressed in the following compact form: 


Xi = X2 

X 2 = Mf^DiX 2 - SiM-^E'^SF(Cx) (7) 

±3 = -S2M-^E^SF(Cx) 

where S = di^g(akj)^k,j}GS ^ ~ [d-mxm ^mxn—m]: £2 ~ 

[On-mx-m In-mxn-m],n = \ff\,m = |5|. Equivalently, 
we have 

x = Ax- BF{Cx), (8) 


with the matrices A, B given by the following expression: 


A = 


Or, 


Or, 

n—mxm 


-'mxm 
Or,,- 


and 


^mxm 

-MfVi 

On—mxm 


o 


mxn—m 


On 

n—mxn—m 


'771X71 — 771 

On- 


B = [ Omx\s\-, SiM-^E^S-, S2M-^E'^S ] . 


The key advantage of this state space representation of the 
system is the clear separation of nonlinear terms that are rep¬ 
resented as a “diagonal” vector function composed of simple 
univariate functions applied to individual vector components. 
This feature will be exploited to construct Lyapunov functions 
for stability certificates in the next section. 
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IV. Quadratic Lyapunov Function-based Stability 
AND Resiliency Certificates 

This section introduces the robust stability and resiliency 
certificates to address the problems (PI) and (P2) by utiliz¬ 
ing quadratic Lyapunov functions. The construction of these 
quadratic Lyapunov functions is based on exploiting the strict 
bounds of the nonlinear vector F in a region surrounding the 
equilibrium point and solving a linear matrix inequality (LMI). 
In comparison to the typically non-convex energy functions 
and Lur’e-Postnikov type Lyapunov functions, the convexity of 
quadratic Lyapunov functions enables the quick construction 
of the stability/resiliency certificates and the real-time stability 
assessment. Moreover, the certificates constructed in this work 
rely on the semi-local bounds of the nonlinear terms, which 
ensure that nonlinearity F is linearly bounded in a polytope 
surrounding the equilibrium point. Therefore, though similar 
to the circle criterion, these stability certificates constitute an 
advancement to the classical circle criterion for stability in 
control theory where the nonlinearity is linearly bounded in 
the whole state space. 

A. Strict Bounds for Nonlinear Couplings 

The representation ([^ of the structure-preserving model Q 
with separation of nonlinear interactions allows us to naturally 
bound the nonlinearity of the system in the spirit of traditional 
approaches to nonlinear control p9)-pT|. Indeed, Figure 
shows the natural bound of the nonlinear interactions (sin 5kj — 
sind^j ) by the linear functions of angular difference {5kj — 
51 j). From Fig. |2| we observe that for all values of 5kj = 
5k — 5j such that7i5f.j| < 7r/2, we have: 

gkj{5kj - 51 < {5kj - 5lj) {sin 5 kj - sin 51^) < {5kj - 5lj) 

(9) 

where 



Fig. 2. Strict bounds of nonlinear sinusoidal couplings (sin 5kj — si niiL ) 
by two linear functions of the angular difference 5kj as described in (12) 


B. Quadratic Lyapunov Functions 

In this section, we introduce the quadratic Lyapunov func¬ 
tions to analyze the stability of the general Lur’e-type system 
which will be instrumental to the constructions of sta¬ 
bility and resiliency certificates in this paper. The certificate 
construction is based on the following result which can be 
seen as an extension of the classical circle criterion to the 
case when the sector bound condition only holds in a finite 
region. 

Lemma 1: Consider the general system in the form 
in which the nonlinear vector F satisfies the sector bound 
condition that {F — KiCx)'^{F — K 2 CX) < 0 for some 
matrices Ki,K 2 and x belonging to the set S. Assume that 
there exists a positive definite matrix P such that 

A^P + PA- C'^kI K 2 C F R^R < 0, (14) 


gkj = min{ 


71/2 - 51 ^ ’ 71/2 + 51 ^ ^ 


l-sin|^*^.| 


( 10 ) 


As the function (1 —sinf)/( 7 r /2 —f) is decreasing on [0, 7 r/ 2 ], 
it holds that 


^ 1 — sin A((5*) 
- ^2 - A((5*) 


:= 5 > 0 


( 11 ) 


where A(<5*) is the maximum value of |(5^^| over all the lines 
G £, and 0 < A(i5*) < 7 < 7 r/ 2 . Therefore, in 
the polytope P, defined by inequalities \5kj\ < 7 r/ 2 , all the 
elements of the nonlinearities F are bounded by: 


g(.^kj - 5*kjf < {5kj - 5lj){sin5kj - sin5lj) < {5kj - 5l^f 

( 12 ) 

and hence, 

{F{Cx) - gCxY{F{Cx) - Cx) < 0,Va; e V. (13) 


where R = B^P — ^{Ki + K 2 )C. Then, the quadratic 
Lyapunov function V{x{t)) = x{t)"’" Px{t) is decreasing along 
trajectory of the system whenever x{t) is in the set S. 


Proof: See Appendix VII-A 


□ 


Note that when iTi = 0 or K 2 = 0 then Condition Cl 
leads to that the matrix A have to be strictly stable. This 
condition does not hold for the case of structure-preserving 
model 0 . Hence in case when Ki = 0 or K2 = 0, it is 
hard to have a quadratic Lyapunov function certifying the 
convergence of the system Q by Lemma Fortunately, when 
we restrict the system state x inside the polytope V defined 
by inequalities \5kj\ < 7r/2, we have strict bounds for the 
nonlinear interactions F as in ( [T^ , in which Ki = gl, K2 = I 
are strictly positive. Therefore, we can obtain the quadratic 
Lyapunov function certifying convergence of the structure¬ 
preserving model Q as follows. 


Lemma 2: Consider power grids described by the 
structure-preserving model 0 and satisfying Assumption 
1. Assume that for given matrices A,B,C, there exists a 
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positive definite matrix P of size (lA/”! + 1^1) such that 


(A - ^(1 + g)BCfP + P{A - i(l + g)BC) 


+ PBB^ P 


To , 


(15) 


or equivalently (by Schur complement) satisfying the LMI 

^2 


A^P + PA+^- 


B^P 


C^C PB 
-I 


< 0 


(16) 


where A = A — Then, along the Lyapunov 

function V{x{t)) is decreasing whenever x{t) S P. 

Proof: From ( |T2l i, we can see that the vector of nonlinear 
interactions F satisfies the sector bound condition; {F — 
KiCxY'{F—K 2 CX) < 0, in which Ki = gl, = I and the 
set S is the polytope V defined by inequalities \Skj\ < tt/2. 
Applying Lemma we have Lemma straightforwardly. □ 
We observe that the matrix P obtained by solving the LMI 
depends on matrices A, B, C and the gain g. Matrices 
A,B,C do not depend on the parameters Pk in the structure 
preserving model 0 . Hence, we have a common triple of 
matrices A, B, C for all the equilibrium point 5* in the set 
A( 7 ). Also, whenever 5* € ^( 7 ), we can replace g in ( [TT] ) 

1 — sin 7 

by the lower bound of p as p = — - - > 0. This lower 

7r/2 — 7 

bound also does not depend on the equilibrium point 5* at 
all. Then, the matrix P is independent of the set A ( 7 ) of 
stable equilibrium points 5*. Therefore, Lemma [^provides us 
with a common quadratic Lyapunov function for any post-fault 
dynamics with post-fault equilibrium point 5* G A ( 7 ). In the 
next section, we present the transient stability certificate based 
on this quadratic Lyapunov function. 


C. Transient Stability Certificate 

Before proceeding to robust stability/resiliency certificates 
in the next sections, we will present the transient stability 
certificate. We note that the Lyapunov function V (x) consid¬ 
ered in Lemma|^is decreasing whenever the system trajectory 
evolves inside the polytope P. Outside P, the Lyapunov 
function is possible to increase. In the following, we will 
construct inside the polytope P an invariant set P of the post¬ 
fault dynamics described by structure-preserving system 0 . 
Then, from any point inside this invariant set P, the post¬ 
fault dynamics 0 will only evolve inside P and eventually 
converge to the equilibrium point due to the decrease of the 
Lyapunov function V(x). 

Indeed, for each edge {k,j} connecting the generator buses 
k and j, we divide the boundary dPkj of P corresponding to 
the equality \Skj\ = 7 r /2 into two subsets dPl^ and 
The flow-in boundary segment dPf!j is defined by \Skj\ = 7 r /2 
and 6kj5kj < 0 , while the flow-out boundary segment dP^J^ is 
defined by \Skj \ = t: 12 and SkjSkj > 0. Since the derivative of 
at every points on dP)Jj is negative, the system trajectory 
of Q can only go inside P once it meets dP)F. 


Define the following minimum value of the Lyapunov 
function V(x) over the flow-out boundary dP°^* as: 

(4iin = min (17) 

where is the flow-out boundary of the polytope P 

that is the union of 97^^“* over all the transmission lines 
{k,j} G S connecting generator buses. From the decrease 
of V{x) inside the polytope P, we can have the following 
center result regarding transient stability assessment. 

Theorem 1: For a post-fault equilibrium point 5* G A ( 7 ), 
from any initial state Xq staying in set P defined by 


P = {X GP :V{x) < Linin}, 


(18) 


then, the system trajectory of 0 will only evolve in the set 
P and eventually converge to the stable equilibrium point 5*. 

Proof: See Appendix VII-B| □ 

Remark 1: Since the Lyapunov function V(x) is convex, 
finding the minimum value I4iin = V (x) can 

be extremely fast. Actually, we can have analytical form of 
\fnin- This fact together with the LMI-based construction of 
the Lyapunov function V(x) allows us to perform the transient 
stability assessment in the real time. 

Remark 2: Theorem provides a certificate to determine 
if the post-fault dynamics will evolve from the fault-cleared 
state xq to the equilibrium point. By this certificate, if xq G P, 
i.e. if Xq G P and V{xo) < Vjniiu then we are sure that the 
post-fault dynamics is stable. If this is not true, then there is 
no conclusion for the stability or instability of the post-fault 
dynamics by this certificate. 

Remark 3: The transient stability certificate in Theorem 

is effective to assess the transient stability of post-fault 
dynamics where the fault-cleared state is inside the polytope 
P. It can be observed that the polytope P contains almost 
all practically interesting configurations. In real power grids, 
high differences in voltage phasor angles typically result in 
triggering of protective relay equipment and make the dynam¬ 
ics of the system more complicated. Contingencies that trigger 
those events are rare but potentially extremely dangerous. 
They should be analyzed individually with more detailed and 
realistic models via time-domain simulations. 

Remark 4: The stability certificate in Theorem is con¬ 
structed similarly to that in ID- The main feature distin¬ 
guishing the certificate in Theorem [T] is that it is based on the 
quadratic Lyapunov function, instead of the Lur’e-Postnikov 
type Lyapunov function as in m- As such, we can have 
an analytical form for I 4 nin rather than determining it by a 
potentially non-convex optimization as in m- 


D. Robust Stability w.r.t. Power Injection Variations 

In this section, we develop a “robust” extension of the 
stability certificate in Theorem [T] that can be used to assess 
transient stability of the post-fault dynamics described by the 
structure-preserving model Q in the presence of power in¬ 
jection variations. Specifically, we consider the system whose 
stable equilibrium point variates but belongs to the set A ( 7 ). 
As such, whenever the power injections Pk satisfy the syn¬ 
chronization condition 0 , we can apply this robust stability 










IEEE TRANSACTIONS ON AUTOMATIC CONTROL, VOL. , NO. , 2016 


7 



Fig. 3. Robust transient stability of the post-fault dynamics originated from 
the fault-cleai'ed state 5o = [0.5 0.5]^ to the set of stable equilibrium points 
A(7r/6) = = [5*,0]^ : -7r/6 < 5* < 7r/6}. 


certificate without exactly knowing the equilibrium point of 
the system Q. 

As discussed in Remark we are only interested in the 
case when the fault-cleared state is in the poly tope V. Denote 
(5 = [5i,(5|p|, (5i,(i|p|, i5|p|+i, 5 | 7 v^|]. The system state 
X and the fault-cleared state xq can be then presented as a; = 
5 — 5* and xq = 5q — 5*. Exploiting the independence of the 
LMl ( [T 6 ] | on the equilibrium point 5*, we have the following 
robust stability certificate for the problem (PI). 

Theorem 2: Consider the post-fault dynamics with 
uncertain stable equilibrium point 5* that satisfies 5* G 
A( 7 ). Consider a fault-cleared state 5o G V, i.e., I^o^jl ^ 
7r/2,\/{k, j} € £. Suppose that there exists a positive definite 
matrix P of size (lA/”! + |(/|) satisfying the LMI ([T 6 | and 

5^P5o < min (5^P5 - 25*^P(5 - 5o)) (19) 

5gO-P°“*.5*GA(7) ^ ' 

Then, the system 0 will converge from the fault-cleared state 
(5o to the equilibrium point <5* for any 5* G A( 7 ). 

Proof: See Appendix V1I-C| □ 

Remark 5: Theorem ^ gives us a robust certificate to as¬ 
sess the transient stability of the post-fault dynamics 0 in 
which the power injections variates. First, we check the 
synchronization condition 0 , the satisfaction of which tells 
us that the equilibrium point 5* is in the set A( 7 ). Second, 
we calculate the positive definite matrix P by solving the LMI 
( [T 6 | i where the gain g is defined as (1 — sin 7 )/( 7 r /2 — 7). 
Lastly, for a given fault-cleared state 5q staying inside the 
poly tope V, we check whether the inequality ([T^ is satisfied 
or not. In the former case, we conclude that the post-fault 
dynamics 0 will converge from the fault-cleared state 5o to 
the equilibrium point 5* regardless of the variations in power 
injections. Otherwise, we repeat the second step to find other 
positive definite matrix P and check the condition ( [T9] ) again. 

Remark 6: Note that there are possibly many matrices P 
satisfying the LMI ( [T 6 | l. This gives us flexibility in choosing 
P satisfying both ( fT 6 | ) and ([W 1 for a given fault-cleared state 
(Jq. a heuristic algorithm as in | ^ can be used to find the best 
suitable matrix P in the family of such matrices defined by 
( fTh] ) for the given fault-cleared state 5o after a finite number 
of steps. 


Remark 7: In practice, to reduce the conservativeness and 
computational time in the assessment process, we can off-line 
compute the common matrix P for any equilibrium point 5* G 
A( 7 ) and check on-line the condition V(xo) < Vmin with the 
data (initial state xg and power injections Pk) obtained on-line. 
In some case the initial state can be predicted before hand, and 
if there exists a positive definite matrix P satisfying the LMI 
and the inequality ( |T9| ), then the on-line assessment is 
reduced to just checking condition 0 for the power injections 

Pk. 

E. Robust Resiliency w.r.t. a Set of Faults 

In this section, we introduce the robust resiliency certificate 
with respect to a set of faults to solve the problem (P2). 
We consider the case when the fault results in tripping of a 
line. Then it self-dears and the line is reclosed. But we don’t 
know which line is tripped/reclosed. Note that the pre-fault 
equilibrium and post-fault equilibrium, which are obtained by 
solving the power flow equations 0 , are the same and given. 

With the considered set of faults, we have a set of corre¬ 
sponding fault-on dynamic flows, which drive the system from 
the pre-fault equilibrium point to a set of fault-cleared states 
at the clearing time. We will introduce technique to bound 
the fault-on dynamics, by which we can bound the set of 
reachable fault-cleared states. With this way, we make sure that 
the reachable set of fault-cleared states remain in the region 
of attraction of the post-fault equilibrium point, and thus the 
post-fault dynamics is stable. 

Indeed, we first introduce the resiliency certificate for one 
fault associating with one faulted transmission line, and then 
extend it to the robust resiliency certificate for any faulted line. 
With the fault of tripping the transmission line {u,v} G £, 
the corresponding fault-on dynamics can be obtained from the 
structure-preserving model 0 after eliminating the nonlinear 
interaction sin 5uv ■ Formally, the fault-on dynamics is 

described by 

xf = Axp — BF{Cxf) + (20) 

where is the unit vector to extract the {m, u} element 

from the vector of nonlinear interactions F. Here, we denote 
the fault-on trajectory as xpit) to differentiate it from the 
post-fault trajectory x{t). We have the following resiliency 
certificate for the power system with equilibrium point 5* 
subject to the faulted-line {u,t;} in the set £. 

Theorem 3: Assume that there exist a positive definite 
matrix P of size (lA/”! + |^|) and a positive number p, such 
that 

A^P + PAf 

4 

+ PBB'^P + pPBD^y^y}D'ly y^B'^P < 0 . ( 21 ) 

Assume that the clearing time Tdearing satisfies Tdearing < 
pVmin where VAin = min^^gapout V(x). Then, the fault- 
cleared state X F (Tdearing) resulted from the fault-on dynamics 
is still inside the region of attraction of the post-fault 
equilibrium point 5*, and the post-fault dynamics following 
the tripping and reclosing of the line {u,u} returns to the 
original stable operating condition. 
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Fig. 4. Robust resiliency of power system with respect to the faults whenever 
the dealing time Tdearing < /iKnin- 


Proof: See Appendix VII-D 


Remark 8: Note that the inequality (|2T]l can be rewritten 


as 


A^P + PA + 


{1-9? 


C^C + PBB^P < 0, 


( 22 ) 


where B = [B ^JJiBD^^y^]. By Schur complement, 
inequality ( |22l l is equivalent with 

a’'P + Pi+fl-^C’'C PB 1 (23) 

B'^P -I 

With a fixed value of /i, the inequality ( |2^ is an LMl which 
can be transformed to a convex optimization problem. As 
such, the inequality ( |2T| ) can be solved quickly by a heuristic 
algorithm in which we vary /i and hnd P accordingly from the 
LMI ( |2^ with hxed p. Another heuristic algorithm to solve the 
inequality ( |2T| ) is to solve the LMI ( [Th] ), and for each solution 
P in this family of solutions, hnd the maximum value of /i 
such that ( |2 T] i is satished. 

Remark 9: For the case when the pre-fault and post-fault 
equilibrium points are different. Theorem still holds true 
if we replace the condition Tdearing < pVmin by condition 

^clearing ^ ^(^pre))) where Xpre — ^pre ^post' 

Remark 10: The resiliency certihcate in Theorem is 
straightforward to extend to a robust resiliency certihcate with 
respect to the set of faults causing tripping and reclosing of 
transmission lines in the grids. Indeed, we will hnd the positive 
dehnite matrix P and positive number ^ such that the inequal¬ 
ity ( |2 T] i is satished for all the matrices corresponding 

to the faulted line {it, v} G £. Let be a matrix larger than or 
equals to the matrices D{u,v}Dju v} transmission 

lines in £ (here, that X is larger than or equals to Y means 
that X—Y is positive semidehnite). Then, any positive dehnite 
matrix P and positive number p, satisfying the inequality ( |2T] l, 
in which the matrix D{u,v}Dj^u v} replaced by D, will 
give us a quadratic Lyapunov function-based robust stability 
certihcate with respect to the set of faults similar to Theorem 

Since = diag(0,..., 1,..., 0) are orthogonal 

unit matrices, we can see that the probably best matrix we can 
have isD = J2{u,v}ee = /|f:|x|£|- Accordingly, 


we have the following robust resilience certihcate for any 
faulted line happening in the system. 

Theorem 4: Assume that there exist a positive definite 
matrix P of size (lA/”! + |^|) and a positive number p such 
that 

A^P + PA + C'^C + (1 -h p)PBB^P < 0. (24) 

Assume that the clearing time Tdearing satisfies Tdearing < 
pVmin where Lmin = V(x)- Then, for any 

faulted line happening in the system the fault-cleared state 
xpix clearing) A Still inside the region of attraction of the 
post-fault equilibrium point 5*, and the post-fault dynamics 
returns to the original stable operating condition regardless 
of the fault-on dynamics. 

Remark 11: By the robust resiliency certihcate in Theorem 
1^ we can certify stability of power system with respect to 
any faulted line happens in the system. This certihcate as well 
as the certihcate in Theorem totally eliminates the needs 
for simulations of the fault-on dynamics, which is currently 
indispensable in any existing contingency screening methods 
for transient stability. 

V. Numerical Illustrations 
A. 2-Bus System 

For illustration purpose, this section presents the simulation 
results on the most simple 2-bus power system, described by 
the single 2-nd order differential equation 

m6dSasinS — p = 0. (25) 

For numerical simulations, we choose to = 0.1 p.u., d = 0.15 
p.u., a = 0.2 p.u. When the parameters p changes from 
—0.1 p.u. to 0.1 p.u., the stable equilibrium point S* (i.e. 
[d* 0]^) of the system belongs to the set; A = (d* : |<5*| < 
arcsin(0.1/0.2) = tt/G}. For the given fault-cleared state 
(5o = [0.5 0.5], using the CVX software we obtain a positive 
matrix P satisfying the LMI and the condition for robust 
stability ([T^ as P = [0.8228 0.1402; 0.1402 0.5797]. The 
simulations conhrm this result. We can see in Fig. [^ that 
from the fault-cleared state do the post-fault trajectory always 
converges to the equilibrium point S* for all 6* G A(7r/6). 
Figure [^ shows the convergence of the quadratic Lyapunov 
function to 0. 

Now we consider the resiliency certihcate in Theorem [^ 
with respect to fault of tripping the line and self-clearing. The 
pre-fault and post-fault dynamics have the hxed equilibrium 
point: 6* = [tt/G 0]^. Then the positive dehnite matrix 
P = [0.0822 0.0370; 0.0370 0.0G03] and positive number 
p = G is a solution of the inequality As such, for 

any clearing time Tdeamng < pVmin = 0.540G, the fault- 
cleared state is still in the region of attraction of d*, and 
the power system withstands the fault. Figure [^ conhrms this 
prediction. Figure [^ shows that during the fault-on dynamics, 
the Lyapunov function is strictly increasing. After the clearing 
time Tdearing, the Lyapunov function decreases to 0 as the 
post-fault trajectory converges to the equilibrium point d*. 
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time (s) 

Fig. 5. Convergence of the quadratic Lyapunov function V{x) = x^Px = 
{S — S*)^P{S — S*) from the initial value to 0 when the equilibrium point 
(5* varies in the set A(7r/6) = = [<5*,0]^ : —irlQ < 5* < rr/6}. 



Fig. 6. Variations of the quadratic Lyapunov function V(x) = x^Px = 
(S — S*)^P(S — S*) during the fault-on and post-fault dynamics. 


B. Robust Resiliency Certificate for 3-Generator System 

To illustrate the effectiveness of the robust resiliency cer¬ 
tificate in Theorem 1^ we consider the system of three genera¬ 
tors with the time-invariant terminal voltages and mechanical 
torques given in Tab. |I] 


Node 

V (p.u.) 

P (p.u.) 

1 

1.0566 

-0.2464 

2 

1.0502 

0.2086 

3 

1.0170 

0.0378 


TABLE I 

Voltage and mechanical input 


The susceptance of the transmission lines are B 12 = 0.739 
p.u., Bi 3 — 1.0958 p.u., and B 23 = 1.245 p.u. The equilib¬ 
rium point is calculated from Q: <5* = [—0.6634 —0.5046 — 
0.5640 0 0 0]^. By using CVX software we can find one 
solution of the inequality (|24| as p. = 0.3 and the positive 



definite matrix P as 


2.4376 

1.7501 

1.8190 

4.0789 

3.9566 

3.9780 

1.7501 

2.3991 

1.8576 

3.9639 

4.0710 

3.9785 

1.8190 

1.8576 

2.3302 

3.9707 

3.9859 

4.0569 

4.0789 

3.9639 

3.9707 

17.2977 

16.6333 

16.7452 

3.9566 

4.0710 

3.9859 

16.6333 

17.2425 

16.8003 

3.9780 

3.9785 

4.0569 

16.7452 

16.8003 

17.1306 


The corresponding minimum value of Lyapunov function is 
\fnin = 0.5536. Hence, for any faults resulting in tripping 
and reclosing lines in £, whenever the clearing time less than 
pVmin = 0.1661, then the power system still withstands all 
the faults and recovers to the stable operating condition at S*. 


C. 118 Bus System 

Our test system in this section is the modified IEEE 118- 
bus test case p2) , of which 54 are generator buses and the 
other 64 are load buses as showed in Eig. The data is 
taken directly from the test files p2| , otherwise specified. 
The damping and inertia are not given in the test files 
and thus are randomly selected in the following ranges; 
rrii € [2,4],Vi € G, and di € [1,2],Vi G Af. The 
grid originally contains 186 transmission lines. We eliminate 
9 lines whose susceptance is zero, and combine 7 lines 
{42,49}, {49,54}, {56,59}, {49,66}, {77,80}, {89,90}, and 
{89,92}, each of which contains double transmission lines 
as in the test files p^ . Hence, the grid is reduced to 170 
transmission lines connecting 118 buses. We renumber the 
generator buses as 1 — 54 and load buses as 55 — 118. 

1) Stability Assessment 

We assume that there are varying generations (possibly due 
to renewable) at 16 buses 1 — 16 (i.e. 30% generator buses 
are varying). The system is initially at the equilibrium point 
given in p2) , but the variations in the renewable generations 
make the operating condition to change. We want to assess if 
the system will transiently evolve from the initial state to the 
new equilibrium points. To make our proposed robust stability 
assessment framework valid, we assume that the renewable 
generators have the similar dynamics with the conventional 
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time (s) 

Fig. 8. Transition of the 118-bus system from the old equilibrium to the 
new equilibrium when the renewable generations increase 50% in the period 
[20s, 30s] 



time (s) 


Fig. 9. Transition of the 118-bus system from the old equilibrium to the 
new equilibrium when the renewable generations decrease 50% in the period 
[20s, 30s] 


generator but with the varying power output. This happens 
when we equip renewable generators with synchronverter 
which will control the dynamics of renewables to mimic the 
dynamics of conventional generators. Using the CVX software 
with Mosek solver, we can see that there exists positive definite 
matrix P satisfying the LMI and the inequality @ 
with 7 = 7r/12. As such, the grid will transiently evolve 
from the initial state to any new equilibrium point in the set 
A(7r/12). To demonstrate this result by simulation, we assume 
that in the time period [20s, 30s], the power outputs of the 
renewable generators increase 50%. Since the synchronization 
condition ||T^p||f,oo = 0.1039 < sin(7r/12) holds true, 
we can conclude that the new equilibrium point, obtained 
when the renewable generations increased 50%, will stay in 
the set A(7r/12). From Fig. we can see that the grid 
transits from the old equilibrium point to the new equilibrium 
point when the renewable power outputs increase. Similarly, 
if in the time period [20s, 30s] the power outputs of the 
renewable generators decrease 50%, then we can check that 
ll-^VlU,oo = 0.0762 < sin(7r/12). Therefore by the robust 
stability certificate, we conclude that the grid evolves from 
the old equilibrium point to the new equilibrium point, as 
confirmed in Fig. 

2) Resiliency Assessment 

We note that in many cases in practice, when the fault 
causes tripping one line, we end up with a new power system 
with a stable equilibrium point possibly staying inside the 
small polytope A ( 7 ). As such, using the robust stability 
assessment in the previous section we can certify that, if the 
fault is permanent, then the system will transit from the old 
equilibrium point to the new equilibrium point. Therefore, 
to demonstrate the resiliency certificate we do not need to 
consider all the tripped lines, but only concern the case when 
tripping a critical line may result in an unstable dynamics, 
and we use the resiliency assessment framework to determine 
if the clearing time is small enough such that the post-fault 
dynamics recovers to the old equilibrium point. 

Consider such a critical case when the transmission line 
connecting the generator buses 19 and 21 is tripped. It can be 


checked that in this case the synchronization condition is 
not satisfied even with 7 « tt/2 since = 1-5963 > 

sin(7r/2). As such, we cannot make sure that the fault-on 
dynamics caused by tripping the transmission line {19,21} 
will converge to a stable equilibrium point in the set A(7r/2). 
Now assume that the fault self-dears and the transmission 
line {19,21} is reclosed at the clearing time Tdearing- With 
fi = 0.11 and using CVX software with Mosek solver on 
a laptop (Intel-core i5 2.6GHz, 8GB RAM), it takes 1172s 
to find a positive definite matrix P satisfying the inequality 
and to calculate the corresponding minimum value of 
Lyapunov function as Umin=0.927. As such, whenever the 
clearing time satisfies Tdearing < = 0.102s, then the 

fault-cleared state is still inside the region of attraction of the 
post-fault equilibrium point, i.e. the power system withstands 
the tripping of critical line and recover to its stable operating 
condition. 

VI. Conclusions and Path Forward 

This paper has formulated two novel robust stability and 
resiliency problems for nonlinear power grids. The first prob¬ 
lem is the transient stability of a given fault-cleared state 
with respect to a set of varying post-fault equilibrium points, 
particularly applicable to power systems with varying power 
injections. The second one is the resiliency of power systems 
subject to a set of unknown faults, which result in line tripping 
and then self-clearing. These robust stability and resiliency cer¬ 
tificates can help system operators screen multiple contingen¬ 
cies and multiple power injection profiles, without relying on 
computationally wasteful real-time simulations. Exploiting the 
strict bounds of nonlinear power flows in a practically relevant 
polytope surrounding the equilibrium point, we introduced the 
quadratic Lyapunov functions approach to the constructions 
of these robust stability/resiliency certificates. The convexity 
of quadratic Lyapunov functions allowed us to perform the 
stability assessment in the real time. 

There are many directions can be pursued to push the 
introduced robust stability/resiliency certificates to the indus¬ 
trially ready level. First, and most important, the algorithms 
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should be extended to more general higher order models of 
generators |34|. Although these models can be expected to be 
weakly nonlinear in the vicinity of an equilibrium point, the 
higher order model systems are no longer of Lur’e type and 
have multi-variate nonlinear terms. It is necessary to extend 
the construction from sector-bounded nonlinearities to more 
general norm-bounded nonlinearities p5) . 

It is also promising to extend the approaches described in 
this paper to a number of other problems of high interest to 
power system community. These problems include intentional 
islanding where the goal is to identify the set of trip¬ 
ping signals that can stabilize the otherwise unstable power 
system dynamics during cascading failures. This problem is 
also interesting in a more general context of designing and 
programming of the so-called special protection system that 
help to stabilize the system with the control actions produced 
by fast power electronics based HVDC lines and FACTS 
devices. Finally, the introduced certificates of transient stability 
can be naturally incorporated in operational and planning 
optimization procedures and eventually help in development of 
stability-constrained optimal power flow and unit commitment 
approaches 0 , 


VII. Appendix 


A. Proof of Lemma 

Along the trajectory of (|^, we have 

V (x) = x^Fx + x^Px = x^{A'^P + PA)x — 2x^PBF 

(26) 


Let W{x) = {F - KiCxY{F - K 2 CX). Then, W(x) < 
0,Vx e S and W(x) = F^F - F^{Ki + K 2 )Cx + 
x"'^KJK 2 CX. Subtracting W from V{x), we obtain: 


V{x) - W{x) = x^iA'^P + PA)x - 2x'^PBF 
- F^F + F^{Ki + K2)Cx - x’^C'^Kf K 2 CX 
= x^{A^P + PA)x - x'^C'^K’[K 2 CX 


'[B'^P- 


{Ki -I- K2)C ^ T _ (-^1 + ^2)C* j 


= x'^ [A^P + PA- C'^K^ K 2 C F R^R] x-S^S, (27) 


where R = B^P - l{Ki + K 2 )C and S' = F -f - 

\[Ki+K2)C)x. 

Note that ( [l4| is equivalent with the existence of a non¬ 
negative matrix Q such that 

A^P F PA- C^K'[ K 2 CF R^R = -Q (28) 


Therefore: 


V[x) = W(x) — x'^Qx — S^S < 0, Va; G S (29) 


B. Proof of Theorem 

The boundary of the set TZ defined as in ( |T8] l is composed of 
segments which belong to the boundary of the polytope P and 
segments which belong to the Lyapunov function’s sublevel 
set. Due to the decrease of V(x) in the polytope P and the 
definition of Vjnim the system trajectory of cannot escape 
the set P through the flow-out boundary and the sublevel- 
set boundary. Also, once the system trajectory of Q meets 
the flow-in boundary, it will go back inside P. Therefore, the 
system trajectory of 0 cannot escape P, i.e. P is an invariant 
set of 0 . 

Since 7?. is a subset of the polytope P, from Lemma 
we have V{x{f)) < 0 for all t > 0. By LaSalle’s Invariance 
Principle, we conclude that the system trajectory of 0 will 
converge to the set {x G P : V{x) = 0}, which together with 
( [29] ) means that the system trajectory of 0 will converge to 
the equilibrium point 5* or to some stationary points lying on 
the boundary of P. From the decrease of V (x) in the polytope 
P and the definition of Lmin, we can see that the second case 
cannot happen. Therefore, the system trajectory will converge 
to the equilibrium point S*. □ 

C. Proof of Theorem 

Since the matrix P, the polytope P, and the fault-cleared 
state (5o are independent of the equilibrium point (5*, we have 

V^in-V{xo)= min {{5 - 5*f P{5 - 5*) 

- ((5o - 5*)^P{5^ - 5*)) 

= min {5'^P6-51P5q-25*'^P{5-5o)) 

= min {6'^P6-25*^P{5-6o))-6lP5o 

(30) 

Hence, if min (f^P5 — 25*'^P(5 — 5tf)) > 

< 5 ea'P°“*,< 5 *GA( 7 ) 

5'^P5q, then Vjnin > V{xq) for all S* G A( 7 ). Applying 
Theorem [T] we have Theorem directly. □ 

D. Proof of Theorem 

Similar to the proof of Lemma [Tlwe have the derivative of 
V(x) along the fault-on trajectoryA| 20 ll as follows: 

V{xf) = x'f'^Pxf F XpPxF = x]^{A^P -f PA)xf 
— 2xpPPP F 2xpPPP>{„^„} sinJp^^ 

= W{xf) — S'^S F 2x'^PBDuv siui5F„„ 

-f xl + PA- C'^Kl K 2 C F P^P] XF (31) 
On the other hand 

2xfPBD{u,v} sin(5F„„ < /2XpPPP{„,„}P>^„_„}P'^PxF 

-I—sin^(5F ■ (32) 

T 

Therefore, 


As such V(x(t)) is decreasing along trajectory x{t) of 0 
whenever x{t) is in the set S. □ 


V{xf) < W{xf) 


S P -f XfQ^F F 


— sin^ 6F 
T 


(33) 
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where Q = A^P + PA - C^K'[K 2 C + R'^R + 
Note that W{xf) < 0,\/xf € V, 

and 

Q = A^P + PA+ c^c 

4 

+ PBB^P + < 0. (34) 

Therefore, 

TfccF) < — sin^ i5_f < —, (35) 

A* 

whener xp in the polytope V. 

We will prove that the fault-cleared state xp^Tdearing) is 
still in the set P. It is easy to see that the flow-in boundary 
g-pm prevents the fault-on dynamics ( |20l l from escaping P. 

Assume that xp{Tciearing) is uot in the set P. Then the 
fault-on trajectory can only escape P through the segments 
which belong to sublevel set of the Lyapunov function V{x). 
Denote r be the first time at which the fault-on trajectory 
meets one of the boundary segments which belong to sublevel 
set of the Lyapunov function V{x). Hence xp{t) G P for all 
0 <t < T. From ( |T5] l and the fact that P we have 

V{xp{t)) -V{xp{0)) = [ V{xp{t))dt<- (36) 

Jo M 

Note that 3:^(0) is the pre-fault equilibrium point, and thus 
equals to post-fault equilibrium point. Hence, y(a:_p(0)) = 0 
and T > /xV(xf(t)). By definition, we have V(xf(t)) = 
X^nin- Theiefoie, T ^ 3^nd thus, Tdearing ^ 

which is a contradiction. □ 
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